Desdev DedeCMS 跨站脚本漏洞

Desdev DedeCMS Dream Weaving Content Management System is a PHP-based open-source content management system CMS of China Zhuozhuo network Desdev company. The system has content publishing, content management, content editing and content retrieval functions. A cross-site scripting vulnerability...

Profile Stealers Spread via LLM-themed Facebook Ads

In this entry, we discuss how a threat actor abuses paid Facebook promotions featuring LLMs to spread malicious code, with the goal of installing a malicious browser add-on and stealing victims’ credentials...

AZL-28594 CVE-2020-22218 affecting package libssh2 for versions less than 1.9.0-3

An issue was discovered in function libssh2packetadd in libssh2 1.10.0 allows attackers to access out of bounds memory...

DEBIAN-CVE-2020-22218

An issue was discovered in function libssh2packetadd in libssh2 1.10.0 allows attackers to access out of bounds memory...

DEBIAN-CVE-2020-26683

A memory leak issue discovered in /pdf/pdf-font-add.c in Artifex Software MuPDF 1.17.0 allows attackers to obtain sensitive information...

UBUNTU-CVE-2020-26683

A memory leak issue discovered in /pdf/pdf-font-add.c in Artifex Software MuPDF 1.17.0 allows attackers to obtain sensitive information...

UBUNTU-CVE-2020-22218

An issue was discovered in function libssh2packetadd in libssh2 1.10.0 allows attackers to access out of bounds memory...

Missing Release of Memory after Effective Lifetime

Overview Affected versions of this package are vulnerable to Missing Release of Memory after Effective Lifetime through the /pdf/pdf-font-add.c component. An attacker can obtain sensitive information by exploiting a memory leak issue. Remediation Upgrade mupdf to version 1.18.0 or higher...

libssh2 缓冲区错误漏洞

libssh2 is a client-side C library that implements the SSH2 protocol, which is capable of executing remote commands, file transfers, as well as providing a secure transmission channel for remote programs. A security vulnerability exists in libssh 2 version 1.10.0, which stems from a security flaw...

MS Teams Outlook Add-in missing

MS Teams is installed on the Master Image MS Teams Outlook Add-in is visible on the Master Image session MS Teams Outlook Add-in is missing on the MCS/PVS VDAs...

CVE-2023-40351

A cross-site request forgery CSRF vulnerability in Jenkins Favorite View Plugin 5.v77a37f62782d and earlier allows attackers to add or remove views from another user's favorite views tab bar...

How to add, delete or modify On-Prem ADM Agent ciphers

Provide the steps to modify ciphers used on ADM Agent on prem...

ChurchCRM Cross-Site Scripting Vulnerability (CNVD-2023-64218)

ChurchCRM is an open source CRM system for churches. A cross-site scripting vulnerability exists in ChurchCRM version 4.2.1, which stems from the lack of effective filtering and escaping of user-supplied data in the Add New Deposit field of the View All Deposit module, and can be exploited by an...

XSS at file uploading

Description In menu Add page, there is a upload file function and xss payload can be injected there. Detail: 1/ Access to the web demo and go to Add page menu. 2/ At upload file function, upload an file with filename is a payload xss. 3/ It will be triggered immediately. Proof of Concept Payload:...

E-Biz CMS 2.0 Cross Site Request Forgery

==================================================================================================================================== | Title : E-Biz CMS v2.0 CSRF Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 69.032-bit | | Vendor :...

CVE-2020-28849

Cross Site Scripting XSS vulnerability in ChurchCRM version 4.2.1, allows remote attckers to execute arbitrary code and gain sensitive information via crafted payload in Add New Deposit field in View All Deposit module...

CVE-2020-28849

Cross Site Scripting XSS vulnerability in ChurchCRM version 4.2.1, allows remote attckers to execute arbitrary code and gain sensitive information via crafted payload in Add New Deposit field in View All Deposit module...

CVE-2020-23595

Cross Site Request Forgery CSRF vulnerability in yzmcms version 5.6, allows remote attackers to escalate privileges and gain sensitive information sitemodel/add.html endpoint...

Yzmcms 跨站请求伪造漏洞

Yzmcms is Yzmcms a set of open source CMS Content Management System. yzmcms 5.6 version of the cross-site request forgery vulnerability , the vulnerability stems from the program does not adequately verify whether the request comes from a trusted user , an attacker can use this vulnerability to...

CVE-2020-28849

Cross Site Scripting XSS vulnerability in ChurchCRM version 4.2.1, allows remote attckers to execute arbitrary code and gain sensitive information via crafted payload in Add New Deposit field in View All Deposit module...